Why can't my email server automatically identify spoofed addresses?

Question

I get this question from business stakeholders a lot, and I have tried to solve this problem on my own. I have a potential approach, but I want to challenge my assumptions.

In my mind, it should be trivial to parse an email header to identify a spoofed address by comparing the fields:

• alias: "John Smith"
• from: jsmith@example.com
• reply-to: jsmith@example.com, or even, group@example.com
• Received: a server-generated address

100% of the phishing incidents I investigate, there is an obvious mis-match in the 4 fields because the attacker manually specified at least one of the first 3 fields. Any mix of the internal or receiver's corporate domain with external domains is a flag. An alias that looks like an email that does not match the from and reply-to is a flag.

But the complexity comes in when the email is:

1. part of a chain
2. forwarded
3. sent to multiple people
4. sent from a email managing service

Figuring out which emails are spoofed can become tricky in these cases, but none of the above conditions exist in my investigations. For instance, a spoofed email or phishing attempt has always been an initial contact from a single outside source. Email managing services are known and easy to whitelist

If this continues to be the case, wouldn't it be trivial to identify and alert on spoofed emails? You have two header fields to parse (from and reply-to), and their contents are predictable and straightforward enough to create a simple regex to test against the alias and Received fields.

Am I missing an element in my assumptions?

Answer 1

I think this method would return a lot of false-positives. One case in particular where you would have false positives is where the sender's organization has their own domain name (senderdomain.com), but they use a third-party hosted outgoing SMTP server (such as their ISP's outgoing SMTP server, or an email hosting company's outgoing SMTP server) to send outgoing mail. This is very common - especially these days, with many large companies outsourcing their mail to Gmail. So, in this case, you would have:

•alias: "Joe Sender"
•from: joe.sender@senderdomain.com
•reply-to: joe.sender@senderdomain.com
•Received: smtp.sendersmailprovider.com

As you can see - in this case, the fourth field (where the name of the outgoing SMTP server that the message was sent through appears) contains nothing that matches with any of the information in the other three fields, so the message would be incorrectly flagged as spam according to your logic.

This is why we have message authentication methods such as SPF and DKIM, which rely on information published in the DNS of the sender's domain to enable spam filters to determine (with reasonable certainty) whether or not a message was in fact sent from the sender that appears in the message's headers.

SPF accomplishes this by explicitly specifying the IP addresses (or range of IP addresses) of SMTP servers that mail from the domain will originate from, in the DNS for the domain.

DKIM accomplishes this by digitally signing messages sent from the domain, where the digital signature is written in the message headers and the public key that is used to verify the digital signature is published in the DNS for the domain.

For more info on how both of these methods work, see https://www.ultrasmtp.com/kb/messageauthentication.php.

Answer 2

It happened many times to me, that I had to use locally provided email to send something, but I needed the reply to came to my main/official account. For example I am at company on Friday evening, I see main server lost connection but cannot be switched off/on for obvious reasons. Moreover on Monday morning it must be fully recovered. I am in position to do it, just need new password for the server and some long binary from coworker, who just leaved and permission to do so from boss already at home. So I write email to those two from my company account, but set reply-to to my home account. Then I go home. Next day I have a password and binary in my email and permission to enter company building on weekend both on my home email, so I can get it, show it to security, get inside and then repair all problems.

There are a lot more scenarios, but this one happened to me personally. Also many times I send invitations to weekend activity to all my friends from work, but with reply-to to my home address as there was no chance to get their replies in time from my work address.

On other hand I occasionally send some official questions from my home mail with reply-to to my work email, as those replies was work related and urgent.

None of that was malicious, but you would reject all this as spoofed spam.

And you know- my company mail is name.surename@company.com, while my home email is nickname@other.server - nothing to match automatically, but everyone (and his dog) knows me better by my nickname, then by my official name.